The contents of an audit permanent file are the documents an auditor needs to reference year after year rather than rebuild each cycle: the entity’s formation and governance records, its long-term contracts and financing agreements, descriptions of its internal control system, historical financial data, and the tax elections that define how it’s treated by the IRS. Unlike current-year workpapers, which cover a single fiscal year and get archived when the engagement closes, the permanent file carries forward indefinitely and is updated rather than replaced. Public companies must retain audit documentation for at least seven years under the Sarbanes-Oxley Act; private companies face a five-year minimum.
What Belongs in the Permanent File
Legal and Organizational Records
The foundation is the paperwork proving who the entity is and how it’s authorized to operate. That starts with formation documents: articles of incorporation, a certificate of formation, or the equivalent state filing, which typically records the registered office and initial incorporators. Corporate bylaws sit alongside them and spell out voting procedures, officer roles, and meeting rules.
Board of directors meeting minutes belong in the file when they document decisions with lasting consequences—mergers, acquisitions, major capital commitments, or shifts in business direction. Routine meeting summaries don’t need a permanent home; the ones that shaped the company’s trajectory do. Having them accessible lets the audit team confirm the company has acted within the scope its governing documents authorize.
Share capital records complete the ownership picture. These track every equity issuance, the number of authorized shares, par values, and the history of stock splits or buybacks. The file should also identify major shareholders. For public companies, anyone crossing the 5% ownership threshold in a registered equity class must file beneficial ownership reports with the SEC, and the permanent file should reflect those disclosures.1U.S. Securities and Exchange Commission. Officers, Directors and 10% Shareholders Organizational charts mapping parent-subsidiary relationships belong here as well, since those structures rarely change mid-year but drive consolidation, related-party transactions, and intercompany eliminations.
Tax Status Elections
Entity classification elections are easy to overlook and critical to preserve. If the company elected S corporation status by filing IRS Form 2553, the original form or proof of filing belongs in the permanent file. The IRS instructions specifically direct the entity to keep the original with its permanent records, and once the election takes effect, it stays in place until revoked or terminated.2Internal Revenue Service. Instructions for Form 2553 Acceptable proof includes a certified mail receipt, a copy stamped by the IRS, or an IRS acceptance letter. The same logic applies to Form 8832 entity classification elections and any other tax election with indefinite duration.
Long-Term Financial and Operational Agreements
Any financial commitment stretching beyond twelve months belongs in the permanent file. Bond indentures and loan agreements are the most common examples, spelling out interest rates, repayment schedules, and restrictive covenants. A covenant requiring a certain debt-to-equity ratio, for instance, has to be tested every audit cycle, and having the original terms immediately available saves time. When amendments occur, the updated terms get appended to the original so future teams can trace the full history.
Long-term real estate and equipment leases go in the file too, particularly given that current lease accounting requires classification and measurement decisions that carry forward for years. Pension plans and labor contracts create employee benefit obligations tied to actuarial calculations that remain relevant for decades. An auditor who doesn’t understand the plan’s benefit formula or vesting schedule can’t meaningfully test the liability. Royalty agreements and significant service contracts round out this category, tracking ongoing revenue or expense streams.
Internal Control Descriptions
The permanent file houses the foundational description of how the client’s accounting system works. That means flowcharts showing how transactions move from initiation to recording, narratives explaining control procedures like segregation of duties and authorization protocols, and internal control questionnaires that identify strengths and weaknesses. These descriptions get updated when processes change, but the baseline stays in the permanent file so each year’s team isn’t rebuilding the picture from scratch.
Historical Financial Data
Historical data gives auditors a baseline for spotting anomalies. Schedules tracking non-depreciable assets like land and goodwill belong here because their balances rarely change, and re-verifying cost basis every year wastes time. A ten-year summary of gross profit margins, revenue trends, or key operating ratios lets the team quickly flag when current-year figures diverge from established patterns. Prior-year analytical procedures and tax-basis information provide context for understanding balance movements.
Fraud Risk Documentation
Fraud risk documentation increasingly lives in the permanent file rather than being rebuilt annually. Written policies on conflicts of interest, procurement thresholds, ethical behavior, and whistleblower protections form the foundation of the fraud risk assessment and don’t change frequently. Annual fraud risk questionnaires, separation-of-duties evaluations, and signed ethical commitments from key officials build on that foundation year over year. Keeping them together lets auditors track whether the control environment is improving or deteriorating over time.
How Long the File Must Be Kept
Retention timelines depend on whether the client is public or private, and confusing them is a common source of trouble during regulatory inspections.
For public companies, PCAOB AS 1215 requires the complete and final set of audit documentation to be assembled within 45 days of the report release date. The seven-year retention clock also runs from the report release date. If no report was issued, the seven years run from when fieldwork was substantially completed or when work stopped.3Public Company Accounting Oversight Board (PCAOB). AS 1215 Audit Documentation – Appendix A The SEC’s rule under 17 CFR 210.2-06 independently requires seven-year retention for records relevant to the audit, including workpapers, memoranda, correspondence, and electronic communications containing conclusions, opinions, analyses, or financial data.4eCFR. 17 CFR 210.2-06 – Retention of Audit and Review Records
For private companies, AICPA AU-C 230 sets a 60-day documentation completion window from the report release date and a minimum five-year retention period.
Rules for Changing or Destroying Records
Documentation can be maintained as paper, electronic files, or other media, but whichever format the firm uses, the content must be detailed enough to convey its purpose, source, and conclusions, and organized so significant findings are easy to locate.5Public Company Accounting Oversight Board (PCAOB). AS 1215 Audit Documentation
Once the documentation completion date passes, audit records cannot be deleted or discarded. Any additions after that date must include the date added, the name of the person who prepared the addition, and the reason for the change.5Public Company Accounting Oversight Board (PCAOB). AS 1215 Audit Documentation
The permanent file also needs an annual review to stay useful. When a contract expires, a subsidiary is sold, or a lease terminates, the outdated documentation should move to a superseded or inactive section rather than staying in the active file where it could mislead someone. The active file should reflect the entity as it currently exists, with historical records accessible but clearly marked as no longer operative.
When a document reaches the end of its required retention period, destruction should follow a documented procedure identifying what was destroyed, when, and by whom. Financial records often require additional approval before destruction. Any document subject to a litigation hold must be preserved regardless of whether its retention period has expired.
Penalties for Mishandling the File
The PCAOB has sanctioned firms for failures as straightforward as not timely assembling a complete set of audit documentation, imposing civil penalties in individual cases.6Public Company Accounting Oversight Board (PCAOB). PCAOB Sanctions Two Firms for Violations Related to Required Audit Records and Disclosure of Key Information for Investors Systemic deficiencies across multiple engagements draw significantly larger sanctions than isolated lapses.
The far greater exposure comes from 18 U.S.C. § 1519, enacted as part of the Sarbanes-Oxley Act. Anyone who knowingly destroys, alters, or falsifies records with the intent to obstruct a federal investigation faces up to 20 years in prison.7Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations The statute isn’t limited to auditors; it covers anyone tampering with documents relevant to a federal matter. Auditors face particular risk because their documentation is exactly the record investigators seek when examining a company’s financial reporting.
Handing the File to a Successor Auditor
When a client changes audit firms, the permanent file becomes the bridge between the outgoing and incoming teams, but the client controls the gate. Before the successor auditor can review the predecessor’s working papers, the client must authorize it. If the client refuses or limits access, the successor has to weigh that in deciding whether to accept the engagement.8Public Company Accounting Oversight Board (PCAOB). AS 2610 Initial Audits – Communications Between Predecessor and Successor Auditors
Auditors cannot disclose information obtained during an engagement without specific client consent, so the predecessor firm typically requests a consent and acknowledgment letter from the client before opening the files. The predecessor may also ask the successor for a written agreement about how the working papers will be used. The predecessor decides which papers to share and which can be copied, so the successor doesn’t automatically receive the entire permanent file.